diff --git a/app/views/dashboard/show.html.erb b/app/views/dashboard/show.html.erb
index ce46d5e..71b2a22 100644
--- a/app/views/dashboard/show.html.erb
+++ b/app/views/dashboard/show.html.erb
@@ -104,7 +104,13 @@
When to arrive
- <% if event_start_local.present? %>
+ <% arrival_window = @event.formatted_arrival_window %>
+ <% if arrival_window.present? %>
+ <%= arrival_window %>
+ <% if event_start_local.present? %>
+ Event starts <%= event_start_local.strftime("%A, %B %-d at %-I:%M %p %Z") %>.
+ <% end %>
+ <% elsif event_start_local.present? %>
Event starts <%= event_start_local.strftime("%A, %B %-d at %-I:%M %p %Z") %>.
An arrival window has not been published. Contact <%= mail_to @event.effective_support_email, @event.effective_support_email, class: "portal-link" %> if you need arrival guidance.
<% else %>
diff --git a/db/migrate/20260920120000_add_arrival_window_to_events.rb b/db/migrate/20260920120000_add_arrival_window_to_events.rb
new file mode 100644
index 0000000..55d5478
--- /dev/null
+++ b/db/migrate/20260920120000_add_arrival_window_to_events.rb
@@ -0,0 +1,6 @@
+class AddArrivalWindowToEvents < ActiveRecord::Migration[8.1]
+ def change
+ add_column :events, :arrival_opens_at, :datetime
+ add_column :events, :arrival_closes_at, :datetime
+ end
+end
diff --git a/db/schema.rb b/db/schema.rb
index ee3b658..69290b5 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
#
# It's strongly recommended that you check this file into your version control system.
-ActiveRecord::Schema[8.1].define(version: 2026_09_20_090000) do
+ActiveRecord::Schema[8.1].define(version: 2026_09_20_120000) do
# These are extensions that must be enabled in order to support this database
enable_extension "pg_catalog.plpgsql"
enable_extension "pg_trgm"
@@ -416,6 +416,8 @@
t.string "airtable_sync_table_id"
t.datetime "airtable_synced_at"
t.string "api_key_digest"
+ t.datetime "arrival_closes_at"
+ t.datetime "arrival_opens_at"
t.jsonb "config", default: {}
t.datetime "created_at", null: false
t.string "docuseal_adult_waiver_template_id"
diff --git a/docs/openapi.yml b/docs/openapi.yml
index 40b5a33..d0edbd9 100644
--- a/docs/openapi.yml
+++ b/docs/openapi.yml
@@ -2061,6 +2061,8 @@ components:
ends_at: { type: string, format: date-time, nullable: true }
registration_open_at: { type: string, format: date-time, nullable: true }
registration_close_at: { type: string, format: date-time, nullable: true }
+ arrival_opens_at: { type: string, format: date-time, nullable: true }
+ arrival_closes_at: { type: string, format: date-time, nullable: true }
venue_name: { type: string, nullable: true }
location_city: { type: string, nullable: true }
location_country: { type: string, nullable: true }
@@ -2142,6 +2144,8 @@ components:
ends_at: { type: string, format: date-time, nullable: true }
registration_open_at: { type: string, format: date-time, nullable: true }
registration_close_at: { type: string, format: date-time, nullable: true }
+ arrival_opens_at: { type: string, format: date-time, nullable: true }
+ arrival_closes_at: { type: string, format: date-time, nullable: true }
venue_name: { type: string, nullable: true, example: Kaapelitehdas }
location_city: { type: string, nullable: true, example: Helsinki }
location_country: { type: string, nullable: true, example: Finland }
diff --git a/spec/javascript/email_domain_controller_test.mjs b/spec/javascript/email_domain_controller_test.mjs
new file mode 100644
index 0000000..43ac20d
--- /dev/null
+++ b/spec/javascript/email_domain_controller_test.mjs
@@ -0,0 +1,77 @@
+import assert from "node:assert/strict"
+import { readFile } from "node:fs/promises"
+import test from "node:test"
+
+const source = await readFile(new URL("../../app/javascript/controllers/email_domain_controller.js", import.meta.url), "utf8")
+const runnable = source.replace('import { Controller } from "@hotwired/stimulus"', "class Controller {}")
+const { default: EmailDomainController } = await import(`data:text/javascript;base64,${Buffer.from(runnable).toString("base64")}`)
+
+function buildController(value) {
+ const input = {
+ value,
+ customValidity: "",
+ classList: {
+ classes: new Set(),
+ add(...names) { names.forEach((name) => this.classes.add(name)) },
+ remove(...names) { names.forEach((name) => this.classes.delete(name)) }
+ },
+ setCustomValidity(message) { this.customValidity = message }
+ }
+ const message = {
+ textContent: "",
+ hidden: true,
+ classList: {
+ add(name) { if (name === "hidden") message.hidden = true },
+ remove(name) { if (name === "hidden") message.hidden = false }
+ }
+ }
+ const controller = new EmailDomainController()
+ controller.inputTarget = input
+ controller.messageTarget = message
+ controller.hasMessageTarget = true
+ controller.domainsValue = [ "hackclub.com", "events.hackclub.com" ]
+
+ return { controller, input, message }
+}
+
+test("rejects an address outside the allowed domains", () => {
+ const { controller, input, message } = buildController("hi@gmail.com")
+
+ controller.validate()
+
+ assert.equal(input.customValidity, "Must be a @hackclub.com or @events.hackclub.com address.")
+ assert.equal(message.textContent, "Must be a @hackclub.com or @events.hackclub.com address.")
+ assert.equal(message.hidden, false)
+ assert.ok(input.classList.classes.has("border-red-500"))
+})
+
+test("accepts the allowed domains regardless of case or padding", () => {
+ for (const value of [ "team@hackclub.com", " Sunbeam@Events.Hackclub.com " ]) {
+ const { controller, input, message } = buildController(value)
+
+ controller.validate()
+
+ assert.equal(input.customValidity, "")
+ assert.equal(message.hidden, true)
+ assert.equal(input.classList.classes.size, 0)
+ }
+})
+
+test("stays quiet until a domain has been typed", () => {
+ for (const value of [ "", "team", "team@" ]) {
+ const { controller, input, message } = buildController(value)
+
+ controller.validate()
+
+ assert.equal(input.customValidity, "")
+ assert.equal(message.hidden, true)
+ }
+})
+
+test("does not accept a lookalike subdomain", () => {
+ const { controller, input } = buildController("hi@evil-hackclub.com")
+
+ controller.validate()
+
+ assert.equal(input.customValidity, "Must be a @hackclub.com or @events.hackclub.com address.")
+})
diff --git a/spec/models/event_spec.rb b/spec/models/event_spec.rb
index dd6ebc9..7133421 100644
--- a/spec/models/event_spec.rb
+++ b/spec/models/event_spec.rb
@@ -45,6 +45,43 @@
end
end
+ describe "#formatted_arrival_window" do
+ let(:event) { build(:event, timezone: "Europe/London") }
+
+ it "is nil when neither end of the window is published" do
+ expect(event.formatted_arrival_window).to be_nil
+ end
+
+ it "reads times in the event's timezone and collapses a same-day window" do
+ event.arrival_opens_at = "2026-08-01T09:00"
+ event.arrival_closes_at = "2026-08-01T11:30"
+ event.validate
+
+ expect(event.formatted_arrival_window)
+ .to eq("Arrive between 9:00 AM and 11:30 AM BST on Saturday, August 1.")
+ end
+
+ it "spells out both dates when the window spans days" do
+ event.arrival_opens_at = "2026-08-01T21:00"
+ event.arrival_closes_at = "2026-08-02T01:00"
+ event.validate
+
+ expect(event.formatted_arrival_window)
+ .to eq("Arrive between Saturday, August 1 at 9:00 PM and Sunday, August 2 at 1:00 AM BST.")
+ end
+
+ it "handles a half-published window" do
+ event.arrival_opens_at = "2026-08-01T09:00"
+ event.validate
+ expect(event.formatted_arrival_window).to eq("Arrive from Saturday, August 1 at 9:00 AM BST.")
+
+ event.arrival_opens_at = nil
+ event.arrival_closes_at = "2026-08-01T11:30"
+ event.validate
+ expect(event.formatted_arrival_window).to eq("Arrive by Saturday, August 1 at 11:30 AM BST.")
+ end
+ end
+
describe "#phase_at" do
let(:event) do
create(:event, timezone: "Europe/London",
diff --git a/spec/requests/admin/event_setup_spec.rb b/spec/requests/admin/event_setup_spec.rb
index 4fd4d9f..cafe470 100644
--- a/spec/requests/admin/event_setup_spec.rb
+++ b/spec/requests/admin/event_setup_spec.rb
@@ -33,6 +33,23 @@
expect(Event.find_by(slug: "outside-con")).to be_nil
expect(response.body).to include("@hackclub.com or @events.hackclub.com")
end
+
+ # The audit log used to choke on the unsaved event (no id, so AuditLog's
+ # record_id validation failed) and re-raise in development, replacing the
+ # 422 form with an exception page that Turbo full-reloaded — the admin saw
+ # the form reset with no error at all. Stubbing find_changed_record leaves
+ # @event as the only audit candidate, which is what a real browser session
+ # hits (the signed-in user there carries no pending changes).
+ it "still renders the errors when the audit log has only the unsaved event" do
+ allow_any_instance_of(Admin::BaseController).to receive(:find_changed_record).and_return(nil)
+
+ post admin_events_path, params: {
+ event: { name: "Outside Con", slug: "outside-con", support_email: "hi@gmail.com" }
+ }
+
+ expect(response).to have_http_status(:unprocessable_entity)
+ expect(response.body).to include("@hackclub.com or @events.hackclub.com")
+ end
end
describe "GET setup (resume)" do
@@ -103,6 +120,19 @@
expect(event.reload.starts_at).to be_present
expect(response).to redirect_to(admin_event_setup_modules_path(event))
end
+
+ it "stores the arrival window in the event's timezone" do
+ event.update!(timezone: "America/New_York")
+
+ patch admin_event_setup_schedule_path(event), params: {
+ event: { arrival_opens_at: "2026-08-01T09:00", arrival_closes_at: "2026-08-01T11:30" }
+ }
+
+ event.reload
+ tz = ActiveSupport::TimeZone["America/New_York"]
+ expect(event.arrival_opens_at.in_time_zone(tz).strftime("%Y-%m-%dT%H:%M")).to eq("2026-08-01T09:00")
+ expect(event.arrival_closes_at.in_time_zone(tz).strftime("%Y-%m-%dT%H:%M")).to eq("2026-08-01T11:30")
+ end
end
describe "PATCH modules" do
diff --git a/spec/requests/registration_completion_states_spec.rb b/spec/requests/registration_completion_states_spec.rb
index 26da91c..1485933 100644
--- a/spec/requests/registration_completion_states_spec.rb
+++ b/spec/requests/registration_completion_states_spec.rb
@@ -106,6 +106,17 @@
expect(response.body).to include("Sign the event waiver")
end
+ it "shows the published arrival window instead of the contact-us fallback" do
+ sign_in user
+ event.update!(timezone: "Europe/London",
+ arrival_opens_at: "2026-08-01T09:00", arrival_closes_at: "2026-08-01T11:30")
+
+ get dashboard_event_path(participant_event)
+
+ expect(response.body).to include("Arrive between 9:00 AM and 11:30 AM BST on Saturday, August 1.")
+ expect(response.body).not_to include("An arrival window has not been published")
+ end
+
it "shows a paused waiting state without an unusable signing action" do
sign_in user
event.update!(guardian_invites_locked: true)
diff --git a/spec/requests/registration_corrections_spec.rb b/spec/requests/registration_corrections_spec.rb
index e7c2622..302b091 100644
--- a/spec/requests/registration_corrections_spec.rb
+++ b/spec/requests/registration_corrections_spec.rb
@@ -52,6 +52,24 @@
expect(participant.reload.legal_first_name).not_to eq("Corrected")
end
+ it "creates a support request that carries no field changes" do
+ staff = create(:user)
+ create(:event_role_assignment, event: event, user: staff, role: :event_admin)
+
+ expect {
+ post dashboard_event_registration_change_requests_path(participant_event), params: {
+ registration_change_request: {
+ kind: "support",
+ staff_audience: "event_admin",
+ requester_note: "I need to talk to someone"
+ }
+ }
+ }.to change(RegistrationChangeRequest, :count).by(1)
+
+ expect(response).to redirect_to(dashboard_event_path(participant_event))
+ expect(RegistrationChangeRequest.last.requested_changes).to eq({})
+ end
+
it "does not let another attendee open the correction form" do
other = create(:user)
other_participant = create(:participant, user: other)